BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-68509FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

6.3 MEDIUMEPSS 0.14%Not in KEVNVD: Received

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
6.3MEDIUM3.1GitHub_M (CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Details

CVE ID
CVE-2026-68509
Status
Received
Assigner (CNA)
GitHub_M
Published
Nov 5, 2026
Last modified
2026-11-05 23:16 UTC
Weaknesses
  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 08:15 UTC.